This issue has supposedly been patched by microsoft in their Sept 26th update (KB5030310)
Reddit thread discussing positive results
I am implementing this update now and will share results in the coming days.
Why obtain "The security log on this system is full" after install Win11 22H2
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous
In the most recent laptops that I installed the latest update of Windows 11 (22H2) every so often that I restart the computer I get the message "The security log on this system is full". I enter the event viewer with another credentials and choose the "Overwrite events" option but after a while it doesn't allow me to log in showing the same previous message and changing back to the "don't overwrite events" option.
Windows for business | Windows Client for IT Pros | User experience | Other
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 25%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Mitchel T. Erb 1 Reputation point2022-12-05T14:23:01.317+00:00 Having similar issues where the Overwrite security logs keeps reverting causing non-privileged users not to be able to login to their machines. All users with the issue are on 22H2...fun times.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(32, 85%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAK%3C/text%3E%3C/svg%3E)
ARUN K 0 Reputation points2023-01-12T17:49:24.9866667+00:00 Getting the same issue.If anybody have a fix please provide.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 99%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Stefan 0 Reputation points2023-07-12T11:45:51.6666667+00:00 Having this same issue on a new Windows 11 Surface.
We've cleared the logs, increased the maximum log size, and changed the settings to "Overwrite event as needed (oldest vents first)", but it just keeps reverting to "Do not overwrite events (Clear logs manually)".
We've also carried out a clean install of Windows and applied the latest updates, but the issue keeps resurfacing.
Really need a lasting fix as this new Surface is all but unusable for the end user.
Sign in to comment
30 answers
Sort by: Newest
-
Anonymous
2023-11-13T20:16:38.5066667+00:00 -
Anonymous
2023-11-14T18:56:05.72+00:00 Did this fix it for you? im on Windows 11 23h2 and the issue still persists. unable to even install the KB
"The update is not applicable to your computer"
Sign in to comment -
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 92%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELB%3C/text%3E%3C/svg%3E)
Lee, Ben 0 Reputation points2023-09-05T17:18:26.32+00:00 This is the explanation I got after submitting a support ticket:
The GP that you are using applies to 2003 and earlier. The “by days” does not work in newer OS, it basically works as “overwrite as needed”. In Windows 11 22h2 the Eventlog code was revamped, so the effect of using this policy is to set retention to “do not overwrite” if the value for Retention is anything but 0 (overwrite). By setting the policy to “by days”, it sets the retention value to days in number of seconds, so it is non-zero, thus the eventlog is set to “do not overwrite”. In combination with the size limit, it will cause the issue the customer is seeing. If you set this policy:
“Computer Configuration > Administrative Templates > Windows Components > Event Log Service > Security > Control Event Log Behavior when the log file reaches its maximum size” to “Disable” The GP will revert the behavior back to “overwrite as needed” and it should work as they were using it before. There are also other Eventlog settings in that GP location that apply to Vista and newer. -
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(19.2, 14.000000000000002%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
Amir Safaei 0 Reputation points2023-07-14T15:43:12.85+00:00 Same issue,
The log security on the computer has been set to overwrite but after reboot is getting back to don't overwrite.
Also, the GPO on the computer and on Domain Controller for "Control Event Log Behavior When The Log File Reaches Its Maximum Size" have been set to Disable, but still the computer with Win 11 is getting blocked.
Hopefully Microsoft can fix this issue on Win 11 after a while.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 38%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHC%3C/text%3E%3C/svg%3E)
Hitesh Chaudhary 6 Reputation points2023-07-26T20:14:55.3933333+00:00 Hi Amir,
Please try this Computer Configuration > Administrative Templates > Windows Component > Event Log Service > Security > Control Event Log Behavior when the log file reaches its maximum size,
Set the security policy to > disabled
Locally on the computer by going to Edit Group Policy and than change the setting on Event Viewer. This should fix your problem of over writing of the settings. I have been applying this to all my Win11 laptops and havent got any user coming back with logs being full.
Thanks
Hitesh
Sign in to comment -
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more